CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
In the Linux kernel, the following vulnerability has been resolved:
ASoC: rsnd: Fix potential out-of-bounds access of componentdais[]
componentdais[RSNDMAXCOMPONENT] is initially zero-initialized and later populated in rsnddaiofnode(). However, the existing boundary check: if (i >= RSNDMAXCOMPONENT)
does not guarantee that the last valid element remains zero. As a result, the loop can rely on componentdais[RSNDMAXCOMPONENT] being zero, which may lead to an out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63838?
The severity of CVE-2026-63838 is rated at 18.
What does CVE-2026-63838 address?
CVE-2026-63838 addresses a potential out-of-bounds access in the component_dais[] array in the Linux kernel's ASoC subsystem.
How can I mitigate CVE-2026-63838?
To mitigate CVE-2026-63838, users should apply the latest Linux kernel patches that contain the fix for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2026-63838?
CVE-2026-63838 affects specific versions of the Linux kernel that include the ASoC subsystem with the vulnerable component_dais[] access.
Is CVE-2026-63838 exploitable in the wild?
As of the latest updates, there is no public information indicating that CVE-2026-63838 is actively being exploited in the wild.